CVE-2026-75709 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager as a Cloud Service. The flaw allows an attacker to manipulate the Document Object Model (DOM) environment in the victim's browser to execute arbitrary JavaScript code. Exploitation requires the victim to interact by visiting a specially crafted webpage. The vulnerability changes the security scope and impacts confidentiality and integrity with no impact on availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, and scope change.

Successful exploitation could lead to execution of malicious scripts in the context of the victim's browser, potentially compromising confidentiality and integrity of user data within the affected application session. There is no known impact on availability. The attack requires user interaction and a crafted webpage visit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, Adobe typically manages remediation server-side; verify with Adobe's official advisory for updates or mitigations. Until a fix is available, users should exercise caution when interacting with untrusted links or webpages related to Adobe Experience Manager as a Cloud Service.